You are correct in that the exact phrase search does not work. I thought we were running a standard phpBBS search module, but have discovered in my ancient notes a mention from Chris that the module was altered to disallow a vulnerability via the exact search function.

I've been looking for a version of our search function module, but have only come up with updated versions (yes, ours is that old!).

The question is, "Is this worth pulling our programmer away from existing projects to fix this"? I'm leaning toward leaving it as is and placing it on my "minor things to do" list.